github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Check syscall helpers in timer callbacks

Browse Source 
A BPF_PROG_TYPE_SYSCALL program is sleepable, but its bpf_timer callbacks
run in a non-sleepable hrtimer softirq context.

Add verifier cases that call bpf_sys_bpf() and bpf_sys_close() from timer
callbacks. Without the syscall helper prototype annotations these programs
load, so their failure expectations expose the bug.

Also add successful controls that call each helper from the syscall program
main body, ensuring that the intended sleepable use remains accepted.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260903144433.1716731-11-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Kumar Kartikeya Dwivedi 2026-09-03 16:44:28 +02:00 committed by Alexei Starovoitov
parent d055247942
commit 26a3a510cd
1 changed files with 64 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
tools/testing/selftests/bpf/progs/verifier_async_cb_context.c
View File

@ -62,6 +62,70 @@ int timer_sleepable_prog(void *ctx)
return 0;
}
static int timer_sys_bpf_cb(void *map, int *key, struct bpf_timer *timer)
{
__u64 attr = 0;
bpf_sys_bpf(BPF_MAP_FREEZE, &attr, sizeof(attr));
return 0;
}
SEC("syscall")
__failure __msg("sleepable helper bpf_sys_bpf#{{[0-9]+}} in non-sleepable prog")
int timer_sys_bpf_prog(void *ctx)
{
struct timer_elem *val;
int key = 0;
val = bpf_map_lookup_elem(&timer_map, &key);
if (!val)
return 0;
bpf_timer_init(&val->t, &timer_map, 0);
bpf_timer_set_callback(&val->t, timer_sys_bpf_cb);
return 0;
}
static int timer_sys_close_cb(void *map, int *key, struct bpf_timer *timer)
{
bpf_sys_close(0);
return 0;
}
SEC("syscall")
__failure __msg("sleepable helper bpf_sys_close#{{[0-9]+}} in non-sleepable prog")
int timer_sys_close_prog(void *ctx)
{
struct timer_elem *val;
int key = 0;
val = bpf_map_lookup_elem(&timer_map, &key);
if (!val)
return 0;
bpf_timer_init(&val->t, &timer_map, 0);
bpf_timer_set_callback(&val->t, timer_sys_close_cb);
return 0;
}
SEC("syscall")
__success
int syscall_sys_bpf_prog(void *ctx)
{
__u64 attr = 0;
bpf_sys_bpf(BPF_MAP_FREEZE, &attr, sizeof(attr));
return 0;
}
SEC("syscall")
__success
int syscall_sys_close_prog(void *ctx)
{
bpf_sys_close(0);
return 0;
}
/* Workqueue tests */
struct wq_elem {